Your data is safe with us.
Encryption at Rest and in Transit
All data stored in our database (Supabase) is encrypted at rest using AES-256. All connections to Layerdock are served over HTTPS with TLS 1.3, ensuring data in transit is fully encrypted. File uploads are encrypted using server-side encryption.
Access Control
We follow the principle of least privilege. Only core engineers with a direct need have access to production infrastructure. All access is logged and audited regularly. Multi-factor authentication is required for all team members with infrastructure access.
Infrastructure
Layerdock is hosted on Vercel (edge + serverless functions) and Supabase (PostgreSQL database + storage), and loads websites under review through a review service on Cloudflare Workers, on a separate domain from the app. All three providers maintain SOC 2 Type II certification and comply with industry-standard security practices including regular penetration testing and 24/7 monitoring.
Authentication
We use Supabase Auth with Google as the sign-in provider. Passwords are never stored on our infrastructure because there are none to store. Authentication is delegated to Google, so your account is protected by whatever multi-factor policy you already enforce there. Session tokens are short-lived, verified on every request, and rotated regularly.
Data Processing
Paddle handles all payment processing as merchant of record. Your card details never touch our servers. Billing data we store is limited to what subscription management requires (plan tier, status, billing period, and the provider-side subscription id).
Vulnerability Management
We run automated dependency scanning and security audits as part of our CI/CD pipeline. We have a responsible disclosure program. If you find a security issue, please report it to security@layerdock.io. We aim to acknowledge reports within 24 hours.